SAP security note 2681207, "[CVE-2018-2465] Missing XML Validation Vulnerability in SAP HANA Extended Application Services Classic Model". Below are the symptom and SAP recommended solution.
Description
Symptom
UPDATE 20 September 2018: This note has been re-released with updated Reason and Prerequisites and Solution information.
SAP HANA, Extended Application Services classic model OData parser does not sufficiently validate XML. By exploiting this vulnerability, an unauthorized hacker can cause the database server to crash.
Solution
The vulnerability has been fixed with:
- Revision 122.13 for SAP HANA 1.00 SPS 12
- Revision 12.02 for SAP HANA 2.0 SPS 1
- Revision 22 for SAP HANA 2.0 SPS 2
SAP HANA 2.0 SPS 3 is not affected. Update to these or later versions.
If an immediate update is not possible, reduce the attack surface by:
- Limiting network access to the Extended Application Services classic model to trustworthy users.
- Enforcing authentication to applications using OData services via Extended Application Services classic model and restricting access to trustworthy users.
Use the following query to identify OData packages without enforced authentication: SELECT DISTINCT T1.PACKAGE_ID FROM (SELECT * FROM "_SYS_REPO"."ACTIVE_OBJECT" WHERE OBJECT_SUFFIX = 'xsodata') AS T1 INNER JOIN (SELECT * FROM "_SYS_REPO"."ACTIVE_OBJECT" WHERE OBJECT_SUFFIX LIKE 'xsaccess' AND (CDATA LIKE '%"authentication": null%' OR CDATA LIKE '%"authentication":null%')) AS T2 ON LEFT(T1.PACKAGE_ID, LENGTH(T2.PACKAGE_ID)) = T2.PACKAGE_ID;
Packages reported by this query might be protected from anonymous access by other means, such as deactivation, authentication enforcement on a lower-level package, or applications not being explicitly exposed. By default, the following OData services are protected by these other means: sap.hana.xs.formLogin.profile, sap.hana.xs.selfService.user.db.
Reason and prerequisites
The vulnerability can be exploited if applications using OData services are enabled on Extended Application Services classic model. This affects applications which are part of the SAP HANA shipment (like the SAP HANA user self-service tool, which is not enabled by default), additional applications by SAP or other vendors, and any customer-built application. If authentication is not enforced for an enabled application using OData, an anonymous attacker can exploit the vulnerability. The attacker needs network access to the HTTP/HTTPS port of the SAP HANA database XS engine classic model.
CVSS
Score 7.5 / 10 Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Full note on SAP: SAP Support Launchpad note 2681207
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
